ci: enable LLM verification when secrets are available

LLM gating already has three layers in autotest: --no-llm flag,
AZURE_OPENAI_ENDPOINT+API_KEY env vars, and per-step verify field.
Fork PRs without secret access automatically skip the LLM block, so
the unconditional --no-llm on PRs was overly defensive.

Internal PRs and scheduled / manual runs with secrets now get LLM
verification of every passing step (downgrades pass -> fail when LLM
is confident the deterministic check was a silent pass).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: wenytang-ms

.github/workflows/e2e-autotest.yml

@@ -200,12 +200,13 @@ jobs:
             if ($vsixFiles) { $autotestArgs += @("--vsix", $vsixFiles) }
           }
 
-          # PRs always test the branch-built VSIX against stable marketplace deps (no LLM, no pre-release).
+          # PRs test the branch-built VSIX against stable marketplace deps.
+          # LLM verification activates automatically when AZURE_OPENAI_* secrets
+          # are available (e.g. internal PRs); fork PRs without secret access
+          # simply skip the LLM step (LLMClient.isConfigured() returns false).
           # Scheduled & manual runs default to --pre-release unless explicitly disabled.
           $isPR = "${{ github.event_name }}" -eq "pull_request"
-          if ($isPR) {
-            $autotestArgs += "--no-llm"
-          } elseif ("${{ inputs.pre_release }}" -ne "false") {
+          if (-not $isPR -and "${{ inputs.pre_release }}" -ne "false") {
             $autotestArgs += "--pre-release"
           }